Operator authentication for a work machine

Patent metadata

Field	Value
Publication number	US-10148634-B2
Application number	US-201615090833-A
Country	US
Kind code	B2
Filing date	Apr 5, 2016
Priority date	Apr 5, 2016
Publication date	Dec 4, 2018
Grant date	Dec 4, 2018

Abstract

A mobile device receives a shared access key corresponding to a work machine. An access code is generated from the shared access key, and from a changing value (such as a time-sensitive value). The access code is transmitted to the work machine which, itself, calculates an access code based on the shared access key and based on the changing value. If the access code provided to the work machine and the access code generated by the work machine match one another, then the work machine unlocks corresponding functionality so that the operator can use the work machine.

First claim

What is claimed is:

1. A mobile work machine, comprising:
functionality components that perform machine functionality;
a control system that controls the functionality components;
an authentication system that receives a first access code that is generated based on a first access key stored on a mobile device and a time varying value and generates a second access code based on a second access key stored on the mobile work machine and the time varying value and compares the first and second access codes and generates an access code comparison signal indicative of the comparison;
access level determination logic that accesses a mapping that maps each of a plurality of different access keys to a different set of machine functionality, and that identifies a particular set of machine functionality corresponding to the second access key, based on the mapping; and
functionality unlock logic that selectively controls the control system to unlock the particular set of machine functionality for implementation with the functionality components, based on the access code comparison signal.

2. The mobile work machine of claim 1 wherein the authentication system comprises:
changing value generator logic that generates the time varying value based on a time at which the time varying value is generated.

3. The mobile work machine of claim 1 wherein the authentication system comprises:
a data store that stores the second access key.

4. The mobile work machine of claim 3 wherein the authentication system comprises:
access code generator logic that obtains the second access key and the time varying value and generates the second access code based on the second access key and the time varying value.

5. The mobile work machine of claim 4 wherein the access code generator logic comprises:
a cryptographic hash component that generates the second access code as a cryptographic hash of the second access key and the time varying value.

6. The mobile work machine of claim 4 wherein the data store stores the plurality of different access keys and wherein the functionality components perform different sets of machine functionality, and wherein the access code generator logic generates a separate access code, based on the time varying value, corresponding to each of the plurality of different access keys.

7. The mobile work machine of claim 6 wherein the authentication system comprises:
comparison logic that compares each separate access code to the first access code to identify a matching access code, of the separate access codes, that matches the first access code.

8. The mobile work machine of claim 7 wherein the comparison logic identifies a matched access key as a given one of the plurality of different access keys that corresponds to the matching access code, and wherein the authentication system comprises:
access level determination logic that identifies the particular set of machine functionality corresponding to the matched access key, the functionality unlock logic controlling the control system to generate control signals that enable operator control of the mobile work machine according to the particular set of machine functionality.

9. The mobile work machine of claim 8 wherein the access level determination logic identifies a scope of authentication indicative of restrictions on the unlocked set of machine functionality, the functionality unlock logic unlocking the particular set of machine functionality, restricted according to the restrictions.

10. The mobile work machine of claim 9 wherein the scope of authentication comprises at least one of a temporal restriction on the unlocked machine functionality, a geographic restriction on the unlocked machine functionality, or a number of uses restriction on the unlocked machine functionality.

11. A mobile device, comprising:
a storage component;
a communication component that loads a first access key, corresponding to a given mobile work machine, into the storage component from a remote computing system, wherein the first access key is identified by the communication component based on a mapping that maps each of a plurality of different access keys to a different level of machine functionality of a different mobile work machine;
access code generator logic that detects an input indicative of a request to generate a first access code, and generates the first access code based on a time-based value and the first access key; and
an interface mechanism that outputs an authentication request, comprising the first access code, for entry into the given mobile work machine to unlock a particular level of machine functionality, on the given mobile work machine, mapped to the first access key in the mapping.

12. The mobile device of claim 11 and further comprising:
changing value generator logic that generates the time-based value.

13. The mobile device of claim 11 wherein the interface mechanism comprises:
a display device that displays the first access code for manual entry into the given mobile work machine.

14. The mobile device of claim 11 wherein the interface mechanism automatically transmits the first access code to the given mobile work machine.

15. The mobile device of claim 13 wherein the communication component loads the plurality of different access keys, each corresponding to a different mobile work machine, into the storage component, from the remote computing system, and further comprising:
user interface logic that controls the display device to display a user actuatable machine identifying display element corresponding to each of the different mobile work machines and to detect user actuation of a given one of the user actuatable machine identifying display elements to identify one of the different mobile work machines.

16. The mobile device of claim 15 wherein the access code generation logic generates the first access code based on the time-based value and one of the plurality of different access keys that corresponds to the identified one of the mobile work machines.

17. An administrative computing system, comprising:
a communication system that obtains a plurality of access keys, each access key corresponding to one or more different sets of machine functionality and being stored on a different mobile work machine;
key sharing logic that detects administrative key sharing inputs and generates permissions, each permission granting an operator access to a corresponding access key, identified in the corresponding permission; and
wherein the communication system updates a mobile device corresponding to the operator with the access key, identified in the corresponding permission, to facilitate implementation of a particular set of machine functionality, corresponding to the identified access key, with a control system of a given mobile work machine.

18. The administrative computing system of claim 17 wherein the communication system obtains a set of access keys for each of the different mobile work machines, each set of access keys having a different access key unlocking one or more of the different sets of machine functionality on the corresponding mobile work machine, the key sharing logic generating the permissions to map the operator to the particular set of machine functionality for which the operator is authorized on a mobile work machine using the set of access keys.

19. The administrative computing system of claim 17 wherein the communication system detects a change to a permission and, in response, automatically updates the mobile device corresponding

Assignees

• Deere & Co

Inventors

• Harwell Drew

Classifications

• H04L63/08 Primary

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L2463/061

  applying further key derivation, e.g. deriving traffic keys from a pair-wise master key · CPC title

• H04W84/18

  Self-organising networks, e.g. ad-hoc networks or sensor networks · CPC title

• H04L63/10

  for controlling access to devices or network resources · CPC title

• H04L9/3226

  using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083) · CPC title